Revert removed-block approach for archived-repo sub-resources

[eliorerz]

Why

The removed block approach from #165 broke the very first real apply after it merged (run 31053762343), blocking the whole pipeline again -- the exact failure mode this whole effort exists to fix, now caused by the fix itself.

removed blocks require the target resource's configuration to be deleted from source entirely. They can't coexist with a resource block that's still declared -- even when that specific module instance is gated to count = 0 / empty for_each -- because modules/common_repository/main.tf's github_branch_protection/github_repository_environment blocks are shared across every repo module, archived or not. Terraform validates this statically, before ever touching real state:

Error: Removed resource block still exists
This statement declares a removal of the resource
module.repo_fulfillment_service.github_branch_protection.repo_protection,
but this resource block still exists in the configuration.

(12 instances of this error, one per archived-repo module × resource type that had a removed block.)

What

Delete removed_archived_repos.tf. Nothing else changes: modules/common_repository/main.tf's count/for_each conditions (count = var.visibility == "private" ? 0 : var.archived ? 0 : ..., for_each = var.archived ? {} : {...}) were never touched by the removed-block commit -- they already correctly stop creating new branch_protection/environment instances for archived repos. That part of #165 was always correct. What's still needed is cleanly detaching the existing, already-tracked instances for the 7 already-archived repos, without an unverified destroy attempt against their archived-repo API -- via tofu state rm once #162's state_rm_addresses mechanism is available, not via removed blocks.

State-removal addresses needed before this PR's own apply succeeds cleanly

I don't have direct Terraform backend credentials, so I could not run tofu state list/tofu show against the real state directly. Instead I cross-checked GitHub's live API for each of the 7 archived repos, for the two resource types at issue (a live object existing is a reliable proxy for "Terraform state still tracks this," since these resource types map 1:1 to a real GitHub object with no complex diffing):

github_branch_protection.repo_protection[0] -- confirmed live (via gh api repos/OWNER/REPO/branches/main/protection) on all 7:

module.repo_fulfillment_service.github_branch_protection.repo_protection[0]
module.repo_cloudkit_operator.github_branch_protection.repo_protection[0]
module.repo_cloudkit_aap.github_branch_protection.repo_protection[0]
module.repo_osac_installer.github_branch_protection.repo_protection[0]
module.repo_host_management_openstack.github_branch_protection.repo_protection[0]
module.repo_bare_metal_operator.github_branch_protection.repo_protection[0]
module.repo_osac_csi_driver.github_branch_protection.repo_protection[0]

github_repository_environment.env["e2e-test"] -- confirmed live (via gh api repos/OWNER/REPO/environments) on 6 of 7 (all except host-management-openstack, which has none):

module.repo_fulfillment_service.github_repository_environment.env["e2e-test"]
module.repo_cloudkit_operator.github_repository_environment.env["e2e-test"]
module.repo_cloudkit_aap.github_repository_environment.env["e2e-test"]
module.repo_osac_installer.github_repository_environment.env["e2e-test"]
module.repo_bare_metal_operator.github_repository_environment.env["e2e-test"]
module.repo_osac_csi_driver.github_repository_environment.env["e2e-test"]

One extra finding, unrelated to the archived-repo guard specifically: bare-metal-fulfillment-operator's current module block in repositories.tf has no environments field at all (var.environments defaults empty), yet it has a live e2e-test environment right now. That's a pre-existing orphaned state entry from before the environments line was apparently removed from that module's config -- it would have been blocking applies via this same archived-repo 409 mechanism regardless of the removed-block saga. Included above since it needs the same state rm treatment; flagging it explicitly since it wasn't part of what I set out to check.

Caveat: this list is derived from live GitHub API cross-checks, not a direct read of the Terraform state file (no backend credentials available to me). Please confirm with a real tofu plan (which will show these as pending destroys once this PR's revert is applied) before running the actual tofu state rm -- that's the authoritative source, this is my best derivation without it.

(fulfillment-service also shows a github-pages environment live -- that's GitHub's own auto-created Pages environment, not something github_repository_environment.env manages, so it's excluded from the list above.)

Test plan

• tofu init -backend=false && tofu validate -- passes (same pre-existing deprecation warnings as always)
• Confirm via real tofu plan that the 13 addresses above (and only those) show as pending destroy
• Run tofu state rm for all 13 via NO-ISSUE: Add one-time TF state rm support for unrefreshable resources #162's state_rm_addresses mechanism once merged
• Confirm a real scheduled/push apply succeeds end to end after both land

Summary by CodeRabbit

• Chores
  • Removed legacy configuration for archived repositories.
  • Archived repository protection and environment resources may now be managed or removed according to the current infrastructure configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 41b93ff7-276f-411b-87d9-0554776b74cb

📥 Commits

Reviewing files that changed from the base of the PR and between fca1abc and 95c9b3c.

📒 Files selected for processing (1)

• removed_archived_repos.tf

💤 Files with no reviewable changes (1)

• removed_archived_repos.tf

---

Walkthrough

The pull request deletes removed_archived_repos.tf. Terraform will no longer preserve branch-protection and environment resources for the listed archived repository module instances.

Changes

Cohort / File(s)	Summary
Archived repository management removed_archived_repos.tf	Deletes the configuration that prevented Terraform from destroying resources for twelve archived repository module instances.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/github-config#165: Directly modifies removed_archived_repos.tf for archived repository resource management.
• osac-project/github-config#158: Marks merged repositories as archived and changes archived-repository protection management.
• osac-project/github-config#161: Archives specific repositories and adjusts their branch-lock configuration.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: reverting the removed-block approach for archived repository sub-resources.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The PR only deletes removed_archived_repos.tf; its 101 lines contained no credentials, and no secret-shaped additions or hardcoded secret literals were introduced.
No-Weak-Crypto	✅ Passed	The PR only deletes removed_archived_repos.tf. The diff and repository searches found no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison usage.
No-Injection-Vectors	✅ Passed	The PR only deletes a Terraform file; it adds no SQL, shell, eval/exec, pickle, YAML loader, OS command, or HTML injection code.
Container-Privileges	✅ Passed	The PR only deletes removed_archived_repos.tf; no container or Kubernetes manifest adds privileged mode, host namespaces, SYS_ADMIN, allowPrivilegeEscalation, or root execution.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only deletes removed_archived_repos.tf; it adds no logging or output code, and the diff contains no secret-shaped values or sensitive data.
Ai-Attribution	✅ Passed	The PR description and commit contain no AI-tool mention; the sole PR commit has Signed-off-by only, with no Co-Authored-By, Assisted-by, or Generated-by trailer.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}